I did run the Eset Online Scanner again - it found & cleaned 1 infected file here's the 1st and 2nd log file ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=8 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6844 # api_version=3.0.2 # EOSSerial=cc4844785a672746b9e71f03e28e7041 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2013-01-08 12:21:10 # local_time=2013-01-07 07:21:10 (-0500, Eastern Standard Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=5892 16777213 88 94 9185604 60484558 0 0 # scanned=99109 # found=2 # cleaned=1 # scan_time=4185 C:\WINDOWS\system32\MP4SDMODO.dll a variant of Win32/Ponmocup.FT trojan (cleaned by deleting - quarantined) FAFC8956CADBAC1E13DDF087F7566E26CA58C01A C $(Memory) probably a variant of Win32/Ponmocup.AA trojan 0000000000000000000000000000000000000000 I esets_scanner_update returned -1 esets_gle=53251 # version=8 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6844 # api_version=3.0.2 # EOSSerial=cc4844785a672746b9e71f03e28e7041 # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-01-08 09:09:38 # local_time=2013-01-08 04:09:38 (-0500, Eastern Standard Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=5892 16777213 88 94 9217312 60519866 0 0 # scanned=99127 # found=1 # cleaned=1 # scan_time=4802 C:\System Volume Information\_restore(840F8D40-D2B2-4CA1-A56C-AE9B7E3B083F)\RP4\A0000165.dll a variant of Win32/Ponmocup.FT trojan (cleaned by deleting - quarantined) FAFC8956CADBAC1E13DDF087F7566E26CA58C01A C I'm sorry if I should have posted this over at Landzdown - I haven't gone there yet as I'm thinking that the malware has been removed. Is that the case???? It's 4:30 am and I'm going to bed now. June

If Avg put them in the vault, then good! leave them there especially if you think there false positives. AVG could end up removing legit files. If that turns out TO BE THE CASE you can restore them FROM THE VAULT... Really need to know the name of the file and where it was!!!! SuperAntiSpyware will always pick up things that Malwarebytes might miss, that's why it's always best to run the 2 in conjunction. Run an ESET online scanner next.........

When Malwarebytes completed it's task it brought up a Notepad screen with the results, similar to the one below ------------------------- Malwarebytes' Anti-Malware 1.40 Database version: 2612 Windows 5.1.2600 Service Pack 3 8/12/2009 2:19:27 PM mbam-log-2009-08-12 (14-19-27).txt Scan type: Quick Scan Objects scanned: 100246 Time elapsed: 3 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) -------------------------------- I created that one doing just the quick scan so I could show you what you would be looking for. To show yours here run the full scan again, click OK when finished and the log should pop up on your screen. In this window click 'Edit' at the top, then 'Select all'. Right click on the highlighted text and click 'Copy'. Then paste it into a post here. Don't worry about the differences between AVG, Avast or Antivir, they all do a good job with a virus, you do not appear to have a virus so use Malwarebytes.

The first time I ran the scan I had 48 infected files. Below are the results of that scan: Malwarebytes' Anti-Malware 1.30 Database version: 1341 Windows 5.1.2600 Service Pack 3 10/31/2008 12:35:40 AM mbam-log-2008-10-31 (00-35-40).txt Scan type: Full Scan (C:\:) Objects scanned: 102474 Time elapsed: 2 hour(s), 39 minute(s), 50 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 38 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 10 Memory Processes Infected: C:\WINDOWS\system32\mabidwe.exe (Trojan.Agent) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\"e4e3e0f8-cd30-4380-8ce9-b96904bdefca> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\"fe8a736f-4124-4d9c-b4b1-3b12381efabe> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\"c9c5deaf-0a1f-4660-8279-9edfad6fefe1> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"1d4db7d2-6ec9-47a3-bd87-1e41684e07bb> (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFinding (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Routing (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WServing (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\roytctm (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\roytctm (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\roytctm (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\soxpeca (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\soxpeca (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\soxpeca (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdydowkc (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\tdydowkc (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdydowkc (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\wsldoekd (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\wsldoekd (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wsldoekd (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\macidwe (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nobicyt (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perfs (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sobicyt (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdxdowkc (Backdoor.Bot) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Program Files\Outlook Express\wab.exe.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore"86FA0783-B9F2-4690-B09B-2E6C03E185B4>\RP113\A0017080.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\afisicx.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\mabidwe.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\noytcyr.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\roytctm.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\soxpeca.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\tdydowkc.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\wsldoekd.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\comsa32.sys (Trojan.Agent) -> Quarantined and deleted successfully. /////////////////////////////////////////////////// So I quarantined them and re-booted and ran the scan again and it showed nothing infected but the same message window that said Resident Sheild Alert Threat name: Trojan Horse Agent.4.E was there above the results of the scan. Below is the logged in results of that scan: Malwarebytes' Anti-Malware 1.30 Database version: 1341 Windows 5.1.2600 Service Pack 3 10/31/2008 1:34:54 PM mbam-log-2008-10-31 (13-34-54).txt Scan type: Full Scan (C:\:) Objects scanned: 102262 Time elapsed: 2 hour(s), 38 minute(s), 57 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Maybe this is the end of it. Maybe. Thanks so much.